What makes digital identity work
Written by Mark Erlich, Senior Expert
Electronic identification and digital identity underpin the modern digital economy, yet countries approach them with very different results. While some have built systems that work seamlessly for citizens and foreign residents alike, others continue to struggle. What explains the gap – technology, economics, governance or something more fundamental?
Before we get into potential issues in implementing electronic identification, we need to define identity. Identity is a set of data that uniquely describes a person, allowing them to be distinguished from others. The set of data that uniquely identifies a person should be as small as possible to minimise the risk of fraud and ensure robust security
When identity is established (enrolled), personal data is collected to create a person’s account in an identity registry. At that point, a unique identifier is created – a single data field that is unique and linked to the person, helping connect the person’s identity to data related to him or her.
The purpose of a unique identifier
A unique identifier can differ depending on the context in which it is used and who has issued it. It may be an e-mail address, a loyalty card number, a national identity number, a social security number or the like. What is most important about a unique identifier is that it links a person’s identity to personal data and other business data related to that person.
Since a unique identifier links data, it exists across different databases and services as a relational key element. If any registry, service or database leaks or exposes data, the unique identifier and related data will be exposed as well – but not the core identity data stored in the registry where the identity was originally enrolled.
For this reason, a unique identifier should not be used as a secret for identity verification. Instead, verification should rely on other methods, such as secure document elements and multi-factor authentication.
Self-declared vs. issued identity
There are different types of identity we use daily, but for simplicity, identity can be divided into two categories: self-declared and issued. With self-declared identity, a person claims an identity by registering data. This data is usually not checked or validated; it is trusted as is. This type of identity is commonly used in social media, e-mail services and communication platforms.
An issued identity, on the other hand, is issued by an organisation or a government. In this case, the issuer is responsible for the trustworthiness of the identity, and identity data is checked and validated during issuance. National identity issued by the government is an obvious example, but so are third-party identities based on national identity – such as those issued by banks, telecom companies or membership programmes – where identity data verification places them firmly in the category of issued identities.
Because issued identities are considered trustworthy, it is essential to maintain high trust throughout the enrolment and verification processes. One of the most dangerous approaches is when an issued identity relies fully or substantially on self-declared identity. This does not mean that self-declared identities (such as Google or Apple accounts) cannot be part of the data collected during enrolment, but such information should not play a substantial role, as there is little or no guarantee that the identity data actually belongs to the person.
From physical to digital
When it comes to proving one’s identity, traditional methods rely on presenting identity documents. An identity document contains basic identity data and a unique identifier (for example, a membership number or national identification number). To verify this data, the document usually includes physical security features such as holograms or microtext, as well as a photograph of the person. By examining these elements, it is possible to verify whether the document is real and authentic and belongs to the person presenting it. In addition, document issuers can provide information about invalidated (revoked) documents.
When identity-proofing moves online, we are talking about electronic identification (eID), where digital identity – identity data presented in digital form – must be verified by a third party. Because the risks of manipulation and forgery are much higher in the digital environment, digital identity data cannot be trusted on its own.
As a result, eID systems perform more complex functions and use secure systems to mitigate risks as much as possible. Encryption is typically one of the core security measures, ensuring that data and verification information are strongly protected. Multi-factor authentication (MFA) is also widely used to verify the identity of the given person.
Most commonly, this involves at least two factors (two-factor authentication, or 2FA): a knowledge-based factor (such as a password or PIN) and a possession-based factor (such as a smartcard, mobile phone or secure account). The possession-based factor must be under the given person’s full control and must ensure (as much as possible) that it cannot be used by a third party without the knowledge of the given person. In many contexts, the solution for the possession-based factor is also called the eID means.
Why eID projects fail
- Lack of knowledge. The most common issue in eID implementation is a lack of knowledge, which often leads to half-done solutions or cancelled projects. Decision-makers want quick results and believe that technology is a miracle solution to existing problems. By demanding fast delivery of digital identity, they miss a fundamental point: without properly functioning identity management, there cannot be a trusted digital identity.
- Lack of a solid identity foundation. Trying to implement eID without a solid identity foundation is like building a house by starting with the roof. First, a functioning core identity and its management system must be in place. If a country does not have a trusted and secure identity system, this needs to be fixed first. The solution may be a dedicated identity system or part of a population registry, if such a registry exists or is planned. Only after that can identity proofing and verification systems be built, such as identity documents and an eID system (including eID means). Implementing a secure national eID system is not simpler than implementing a new passport ecosystem. In fact, it is often more complex, as it involves a wider scope of implementation and support.
- Semantic confusion. Semantic issues also contribute to misunderstandings and unsuccessful implementations. Problems often begin with an unclear understanding of what terms such as eID, digital identity and identity management actually mean and how they relate to one another. This frequently leads to the following situation: the buyer believes they know what they want but describes it using the wrong terms. The bidder delivers what they believe the procurer has asked for. In the end, something is delivered, but it barely works – if at all – and no one is satisfied.
Learning from experience
eGA brings nearly three decades of expertise in identity management, rooted in Estonia – one of the world’s earliest and most successful eID implementations. Working with governments across diverse contexts, eGA experts understand how different identity models function in different societies.